Enterprise networks constantly face the threat of valuable and sensitive data being stolen by cyber-attackers. Sophisticated attackers are increasingly exploiting the Domain Name System (DNS) service for exfiltrating data as well as maintaining tunneled command and control communications for malware. This is because DNS traffic is usually allowed to pass through enterprise firewalls without deep inspection or state maintenance, thereby providing a covert channel for attackers to encode low volumes of data without fear of detection. This paper develops and evaluates a real-time mechanism for detecting exfiltration and tunneling of data over DNS. Unlike prior solutions that operate off-line or in the network core, ours works in real-time at the enterprise edge. Our first contribution is to collect and analyze real DNS traffic from two organizations (a large University and a mid-sized Government Research Institute) over several days and extract numerous stateless attributes of DNS messages that can distinguish malicious from legitimate queries. Our second contribution is to develop, tune, and train a machine-learning algorithm to detect anomalies in DNS queries using a benign dataset of top rank primary domains. To achieve this, we have used 14 days-worth of DNS traffic from each organization. For our third contribution, we implement our scheme on live 10 Gbps traffic streams from the network borders of the two organizations, inject more than three million malicious DNS queries generated by two exfiltration tools, and show that our solution can identify them with high accuracy. We compare our solution with the two-class classifier used in prior work. We draw insights into anomalous DNS queries of two enterprise networks by their anomaly scores, the trace of query count over time, enterprise hosts querying them, and TTL and Type fields of their corresponding responses. Our tools and datasets are made available to the public for validation and further research.

The Internet of Things (IoT) is aimed to provide efficient and seamless connectivity to a large number of low-power and low-cost embedded devices, consequently, the routing protocols play a fundamental role in achieving these goals. The IETF has recently standardized the IPv6 Routing Protocol for Low Power and Lossy Networks (RPL) for LLNs (i.e., Low-power and Lossy Networks) and is well-accepted among the Internet community. However, RPL was proposed for static IoT devices and suffers from many issues when IoT devices are mobile. In this paper, we first present various issues that are faced by the RPL when IoT devices are mobile. We then carry out a detailed survey of various solutions that are proposed in the current literature to mitigate the issues faced by RPL. We classify various solutions into five categories i.e., ‘Trickle-timer based solutions’, ‘ETX based solutions’, ‘RSSI based solutions’, ‘Position-based solutions’, and ‘Miscellaneous solutions’. For each category of these solutions, we illustrate their working principles, issues addressed and make a thorough assessment of their strengths and weaknesses. In addition, we found several flaws in the performance analysis done by the authors of each of the solutions, e.g., nodes mobility, time intervals, etc., and suggest further investigations for the performance evaluations of these solutions in order to assess their applicability in real-world environments. Moreover, we provide future research directions for RPL supporting various real-time applications, mobility support, energy-aware, and privacy-aware routing.

Enterprise networks are under enormous threats from sophisticated cyber-attacks. Various kinds of malware are installed by attackers on compromised hosts, acting as bots that typically use Domain Generation Algorithms (DGAs) to communicate with their Command and Control (C&C) servers. It is computationally expensive to inspect all network packets of every host connected to a large enterprise network in “real-time” at scale with hundreds of gigabits per second data rates. This paper combines Software Defined Networking (SDN) and machine learning to develop an accurate, cost-effective, and scalable system for detecting infected hosts communicating with external C&C servers, subsequent to the resolution of DGA query names. Our solution dynamically selects network flows for diagnosis by trained models in real-time, and relies more on the behavioral traffic profile, rather than packet content. Our first contribution highlights the prevalence and activity pattern of DGA-enabled malware across internal hosts. We draw insights into the behavioral profile of DGA-enabled malware flows when communicating with C&C servers. For our second contribution, we identify malware traffic attributes and train three specialized one-class classifier models using behavioral attributes of malware HTTP, HTTPS and UDP flows. We develop an SDN-based monitoring system to automatically mirror TCP/UDP flows pertinent to DGA queries for diagnosis by the trained models. Finally, we evaluate the efficacy of our approach by testing suspicious traffic flows (selectively recorded by SDN reactive rules), identifying infected hosts, and verifying our detection with an off-the-shelf Intrusion Detection System (IDS) software tool.

The increasing adoption of solar power globally presents an environmentally sustainable alternative to traditional energy sources. However, integrating solar distributed generation (DG) systems into the power grid introduces complexities that can impact the grid’s reliability and security. While information and communication technologies have significantly improved the management and control of solar DG systems, they concurrently introduce new cybersecurity vulnerabilities. This study explores the security and stability challenges introduced by solar DG systems, with a specific focus on the vulnerabilities in commercial solar inverters. Additionally, it assesses the operational and economic consequences of cybersecurity incidents directed at commercial solar inverters within the energy sector, with a particular emphasis on the Australian grid. Given the vulnerabilities and potential impacts identified, the paper proposes recommendations to enhance the cybersecurity posture of solar DG systems. The primary aim of this article is to enrich the understanding and mitigation strategies for cybersecurity risks associated with solar inverters, thereby ensuring the power grid’s reliable and secure operation. This contribution is critical for stakeholders across the energy sector as it underscores the need for robust cybersecurity measures in the face of increasing reliance on solar DG systems.

The exponential rise in popularity of distributed energy resources (DERs) is attributed to their numerous benefits within the power sector. However, the risks that new DERs pose to the power grid have not yet been closely assessed, exposing a gap in the literature. This article addresses this gap by presenting a comprehensive threat model of the DER architecture, combining the MITRE ATT&CK catalogue for industrial control systems (ICS), and the IDDIL/ATC threat model, to create a hybrid approach. Our first contribution is to propose criteria derived from seven metrics to evaluate and compare the efficacy and usability of threat modelling frameworks for DER systems, allowing more informed framework selection. Our second contribution is to develop a comprehensive hybrid threat modelling approach based on IDDIL/ATC and MITRE ATT&CK and organise attack paths chronologically using the cyber kill chain methodology to categorise attacker techniques. Our third contribution is to perform a comprehensive DER architecture system decomposition, elaborating assets, trust levels, entry points, data, protocols, and entity relations to identify the threat landscape. Our final contribution is to apply the proposed approach to the distribution system operator (DSO), mapping potential attacker techniques and illustrating a ransomware attack chain on the DSO's Energy Management System, with proposed mitigations.